��N�v�'ȩw��B(��-�MٵP�8��8O+���+��1���f���o^8Ud�R������/B̌��b�� ��Q�i�4�J8����2������>a�C�e&��^&�Vww��T0����w�Ƌ���Ho6*���s�J��� ����#���[��j >d����ǰ8^����Fk�lڢU�V�!���6�����\�4��wm�����;��'q�"P�O|�"X�e�7ц�͏im)�_�t���? ��H��ܷK��:_:�$���m����m��x�(o&�I3K8��A}|A��eAO$Q��'XT[���|��UD#Ue+�롹̦�/����s���ɒ�o��}�5�S��z\F9�Xw ����ww���*8�7�5c�}ڜn ������t�`!����ɛ���Pz5� Ń3�1%=��<?�f05�sIp�E��NO&�Itp�P����ౌEu�Wt�%�X����������C(U�t�zE��*{�C*3]���(X���<�2L*�#�j�h<�iR��kp#�\ �Ve��`��뿇uZ�8�DO��ɻ{����>�?5.q%��V�%�NO!b��(8F˥2����2 �R�_7r��[���Lg��CE[�!,�%�5����UB�4N���aD����x����������v]�? ?�?�/�4`�H\z���y�h���ߺ9X�x�'�����>娶2��DBB�J�j� ��P��,�J���zf�H�^���j�i�6�j^�����E��,��.���n�τՊ�t�~%z��椧��~J�)��*��fNsl��A�HM2j��Ι^@Y��SY����jw�߿�"��غPp÷�I8�]����x�{-�2�ӳ| �jd��q� <p���a�D��l�b� ��zZ���5��L�Q����6��@A�x����E��/0���l즥S��h�Ts����;b�r'��5��4<�|�b��a�'�887�iAe ��ӷ��~ȡ��б����*�Ը��Oּ�7*i ©߲r�ߙ?{�!�°��m��Ii.=_�&QBz�+��� �HL�J���i�U�@$��K��h�Bs;��U���: �S�#���3��3*�J�qP��k���c575��ڄPo���س��j��0��Np�D �>��+Y�Gks1����v��o7���f���p�0e���w5k�7�zL��3 _A�Z�F=��>�Aơ�Ӯ|� x��XZƁ��ħ�1E����A��IHi#�����!s���R����kyM<��"�U�G�6�b���7JVHA�oY���Ū&��\w�+����Q��[1�����S��] h�k��7y�%���S�I"R�В���`��FE�����ǤH�X��GC��1�}��;��[��^՞?�&:����f&+ܠK�F�1��&���?L}��Q���Š���7}w�؉U[2C���zv�)"D0A��~�n��F��}��8i�?t�Ka��̃ m3J�F5�����s��G��|���N�M>�=(�p�.��<��HkD��3KgJ!f�M|B�Y�(V�vET3�y�9�f�����������H������)�"~����^L����;v]W0�0�6��Q��>����H�}�6�B/U@�����_{����T\�9�V n�)WH,�&q��Dt������*)$���2��AC(M��=f���2�Z�P*�J�e_�w2�Vs���d�E�p=��<����i� �`���-�[uݷ��x�85K���4��tzy?�$��ܘ*���Jd�4V�,W�W u&x �!�&S���\�6R��i�@�0J����.x<��_"8�x7C�� rd��i��/1dA��<�%[y��Ϭ����v���ƈ����2//��k��ʚѶ� �i�9�z����]4��e�P&�ST��j�DQ�,�.�r�Uh�����ꊧ-��uI8��3}y:Z�Y:Zj��&o�<�Ԛ�8��/��S�`,�8@o���f2�S��^�^�VZ��M;���;���B�Y~c-g��l�a��3<*L�~�2M4��7k9�]~F��N$�#K���È���D@ �!�(g�` ���uy Tc�8�rG.�E�'��Я�Ah��͏7��Ѷ�#\��<�Nj���ҋ����"���� 0O��m�B�jy�R�(�d�4���1}��c{�/]\ÞT�m�4J��n歲���I"�"�j܀;�J#�"{���l�W�#VB�,l:b9k 4>s��� 2����[��~K�p�\�K 39�(��o�ڡ�'0����BX[1���*�|�8�L)R!]�g����t�.0A7���<���_�̮pSU�(G��G/���D�������,�y!�K�[���=�JO����# \H.{ǧ��Y( ��%h��a�b��=��̖sMB����a�-������"?V1�+�5g�MvWf$��z������.�BQh F���~���\���+LY �i�LZ�>cA�MM���KQ\p�,Q�u_-��y[��/�8�a�4T)#����}�AL��K�*� �9p�� ������Ԑm��������IZ�A̦���;�X�*>��P_G����w��u��vѳB��u�w��hs��h^� �Lq�]2֟]�9+�ߒ2��H>�~SH�n<E����� ��č�Ur!E<�-�;p�4 4 #� �030#P�����^b7���t��V.� ���٬��ɫ{��Q���d�>y�1{�ƨ��e��t�E��t�T���FP���2����q8��5a=�Cd�[1b�{�=S��ǠH§K7��}c�^E� �Y>�0{A�1yL��+��0pW;��Q۹I�U ���~k���i�8�-XJ����hED��> ��(��Q�[���)7�B~��y�q�w�P�¼� �5�\�T0��j9T@�LZc+��t}=Ȼ��x�0[���o�r �X����ĝ5F*��b]1�����F`J5)#�;,���J|��s���-39^��Z+��:�@I�[�nvh2�����"���U'��qa��9��}ر횄l1`�-�66�����
Static task
static1
Behavioral task
behavioral1
Sample
COD_-_WZ_-_MW3_-.exe
Resource
win11-20240611-en
General
-
Target
COD_-_WZ_-_MW3_-.exe
-
Size
5.8MB
-
MD5
019dee42770fb78f962a613b74b604d3
-
SHA1
f458d14ba1739bf514cd9f6e650d2839940689f2
-
SHA256
09a02df2fdcaa6801c2e6592c849f6cb4435114aaff4e6293d98f8c3d2d51c2b
-
SHA512
0e12574a66f54fd05127a4939f905e06feeeba82a1b82f5d38f8b110e52a2225cd7532d8c21ca70870049c7a644002347330d1ae2e6020ede5e6c67262e1b042
-
SSDEEP
98304:a6+WMD5y01AW9krBRnp6GjM4Kb+N1ZXCgFae7P14Pe1BIWK1jwHg6s:10Vy06kkVZptwZbC1Zzlm8IWawA3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource COD_-_WZ_-_MW3_-.exe
Files
-
COD_-_WZ_-_MW3_-.exe.exe windows:6 windows x64 arch:x64
c2593031d04f9eeb10dcc863fce89a29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
ntdll
RtlLookupFunctionEntry
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertFreeCertificateChain
ws2_32
closesocket
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
advapi32
AddAccessAllowedAce
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SPO0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SPO1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ